[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CKMZDK5AV8P23V0TT13F4":3,"skill-same:01M71CKMZDK5AV8P23V0TT13F4":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M71CKMZDK5AV8P23V0TT13F4","kubernetes-general-overview-analyze",null,"Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fgeneral\u002Foverview\u002Fanalyze\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"kubernetes","general","overview","kubernetes general overview analyze","analyze","auditing kubernetes cluster rbac","read","rbac","privilege escalation","aks","cloud-security","gke","eks","de","permissions","kubeaudit","Bash","access","cybersecurity","cm","2026-11-10 10:12:30",false,"---\nname: kubernetes-general-overview-analyze\ndescription: Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- kubernetes\n- rbac\n- access-control\n- eks\n- gke\n- aks\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1021\n- T1610\ncapec: []\n---\n\n# Auditing Kubernetes Cluster RBAC\n\n## When to Use\n\n- When performing security assessments of Kubernetes clusters (EKS, GKE, AKS, or self-managed)\n- When validating that RBAC policies enforce least privilege for users and service accounts\n- When investigating potential lateral movement or privilege escalation within a Kubernetes cluster\n- When compliance audits require documentation of access controls and permissions\n- When onboarding new teams to a shared cluster and defining appropriate RBAC policies\n\n**Do not use** for network policy auditing (use Cilium or Calico network policy tools), for container image scanning (use Trivy or Grype), or for runtime security monitoring (use Falco or Sysdig Secure).\n\n## Prerequisites\n\n- kubectl configured with cluster-admin or equivalent read permissions to the target cluster\n- rbac-tool installed (`kubectl krew install rbac-tool` or binary from GitHub)\n- KubiScan installed (`pip install kubiscan`)\n- Kubeaudit installed (`brew install kubeaudit` or from GitHub releases)\n- Access to the cluster's audit logs for correlating RBAC findings with actual API access\n\n## Workflow\n\n### Step 1: Enumerate ClusterRoles and Roles with Dangerous Permissions\n\nIdentify roles with wildcard permissions, secret access, pod exec, or escalation capabilities.\n\n```bash\n# List all ClusterRoles with wildcard verb access\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        verbs = rule.get('verbs', [])\n        resources = rule.get('resources', [])\n        if '*' in verbs or '*' in resources:\n            print(f'ClusterRole: {name}')\n            print(f'  Verbs: {verbs}')\n            print(f'  Resources: {resources}')\n            print(f'  API Groups: {rule.get(\\\"apiGroups\\\", [])}')\n            print()\n\"\n\n# Find roles that can read secrets\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        verbs = rule.get('verbs', [])\n        if ('secrets' in resources or '*' in resources) and ('get' in verbs or 'list' in verbs or '*' in verbs):\n            if not name.startswith('system:'):\n                print(f'ClusterRole: {name} -> can access secrets (verbs: {verbs})')\n\"\n\n# Find roles with pod\u002Fexec permissions (container escape risk)\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        if 'pods\u002Fexec' in resources or 'pods\u002F*' in resources:\n            print(f'ClusterRole: {name} -> has pods\u002Fexec access')\n\"\n```\n\n### Step 2: Audit ClusterRoleBindings and RoleBindings\n\nReview bindings to identify who has elevated access and detect overly broad group assignments.\n\n```bash\n# List all ClusterRoleBindings with the subjects\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    name = binding['metadata']['name']\n    role = binding['roleRef']['name']\n    subjects = binding.get('subjects', [])\n    for subject in subjects:\n        kind = subject.get('kind', '')\n        subj_name = subject.get('name', '')\n        ns = subject.get('namespace', 'cluster-wide')\n        print(f'{name} -> Role: {role} | {kind}: {subj_name} ({ns})')\n\" | sort\n\n# Find bindings to cluster-admin\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    if binding['roleRef']['name'] == 'cluster-admin':\n        print(f\\\"Binding: {binding['metadata']['name']}\\\")\n        for subject in binding.get('subjects', []):\n            print(f\\\"  {subject.get('kind')}: {subject.get('name')} (ns: {subject.get('namespace', 'N\u002FA')})\\\")\n\"\n\n# Find bindings granting access to all authenticated users\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    for subject in binding.get('subjects', []):\n        if subject.get('name') in ['system:authenticated', 'system:unauthenticated']:\n            print(f\\\"WARNING: {binding['metadata']['name']} grants {binding['roleRef']['name']} to {subject['name']}\\\")\n\"\n```\n\n### Step 3: Scan with rbac-tool for Comprehensive Analysis\n\nUse rbac-tool for automated RBAC analysis including who-can queries and policy generation.\n\n```bash\n# Who can get secrets across all namespaces\nkubectl rbac-tool who-can get secrets\n\n# Who can create pods (potential for container escape)\nkubectl rbac-tool who-can create pods\n\n# Who can exec into pods\nkubectl rbac-tool who-can create pods\u002Fexec\n\n# Who can escalate privileges (bind\u002Fescalate verbs)\nkubectl rbac-tool who-can bind clusterroles\nkubectl rbac-tool who-can escalate clusterroles\n\n# Generate RBAC policy report\nkubectl rbac-tool analysis\n\n# Visualize RBAC relationships\nkubectl rbac-tool viz --outformat dot > rbac-graph.dot\ndot -Tpng rbac-graph.dot -o rbac-graph.png\n```\n\n### Step 4: Run KubiScan for Risky Permissions Detection\n\nUse KubiScan to automatically identify risky service accounts, pods, and RBAC configurations.\n\n```bash\n# Run KubiScan to find risky roles\npython3 -m kubiscan -rroles   # List risky Roles\npython3 -m kubiscan -rcr      # List risky ClusterRoles\npython3 -m kubiscan -rrb      # List risky RoleBindings\npython3 -m kubiscan -rcrb     # List risky ClusterRoleBindings\n\n# Find risky service accounts\npython3 -m kubiscan -rs       # Risky service accounts\n\n# Find pods running with risky service accounts\npython3 -m kubiscan -rp       # Risky pods\n\n# Check for privilege escalation paths\npython3 -m kubiscan -pe       # Privilege escalation vectors\n\n# Generate full report\npython3 -m kubiscan -a        # All checks\n```\n\n### Step 5: Audit Service Account Token Mounting and Usage\n\nCheck for unnecessary service account token mounts that could enable lateral movement from compromised pods.\n\n```bash\n# Find pods with automounted service account tokens\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    sa = pod['spec'].get('serviceAccountName', 'default')\n    automount = pod['spec'].get('automountServiceAccountToken', True)\n    if automount and sa != 'default':\n        print(f'{ns}\u002F{name} -> SA: {sa} (token auto-mounted)')\n\"\n\n# Find service accounts with non-default token secrets\nkubectl get serviceaccounts --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor sa in data['items']:\n    name = sa['metadata']['name']\n    ns = sa['metadata']['namespace']\n    secrets = sa.get('secrets', [])\n    if name != 'default' and len(secrets) > 0:\n        print(f'{ns}\u002F{name}: {len(secrets)} secret(s) bound')\n\"\n\n# Check for pods running as privileged or with host access\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    for container in pod['spec'].get('containers', []):\n        sc = container.get('securityContext', {})\n        if sc.get('privileged', False) or sc.get('runAsUser', 1) == 0:\n            print(f'RISK: {ns}\u002F{name}\u002F{container[\\\"name\\\"]} - privileged={sc.get(\\\"privileged\\\",False)} runAsRoot={sc.get(\\\"runAsUser\\\",\\\"not set\\\")==0}')\n\"\n```\n\n### Step 6: Run Kubeaudit for RBAC and Security Policy Validation\n\nExecute Kubeaudit for comprehensive security checks including RBAC-related findings.\n\n```bash\n# Run all kubeaudit checks\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig\n\n# Run specific RBAC-related checks\nkubeaudit privesc    # Check for allowPrivilegeEscalation\nkubeaudit rootfs     # Check for readOnlyRootFilesystem\nkubeaudit nonroot    # Check for runAsNonRoot\nkubeaudit capabilities  # Check for dangerous capabilities\n\n# Output as JSON for processing\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig -f json > kubeaudit-results.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| RBAC | Role-Based Access Control in Kubernetes, a method for regulating access to cluster resources based on the roles of individual users or service accounts |\n| ClusterRole | Cluster-wide role definition that specifies permissions (verbs on resources) applicable across all namespaces |\n| ClusterRoleBinding | Associates a ClusterRole with subjects (users, groups, service accounts) at the cluster scope |\n| Service Account | Identity associated with pods for authenticating to the Kubernetes API server, automatically mounted unless disabled |\n| automountServiceAccountToken | Pod spec field controlling whether the service account token is automatically mounted into the pod filesystem |\n| Privilege Escalation | RBAC verbs (bind, escalate, impersonate) that allow a user to grant themselves or others elevated permissions |\n\n## Tools & Systems\n\n- **kubectl**: Primary CLI for querying Kubernetes RBAC resources (roles, bindings, service accounts)\n- **rbac-tool**: kubectl plugin for RBAC analysis including who-can queries, visualization, and policy generation\n- **KubiScan**: Python tool for scanning Kubernetes RBAC for risky permissions and privilege escalation paths\n- **Kubeaudit**: Security auditing tool that checks pods and workloads for security anti-patterns including RBAC issues\n- **rakkess**: kubectl plugin showing access matrix for the current user across all resource types\n\n## Common Scenarios\n\n### Scenario: Auditing an EKS Cluster Shared by Multiple Development Teams\n\n**Context**: A shared EKS cluster serves four development teams. RBAC was configured during initial setup but has not been reviewed in 12 months. Teams report being able to access other teams' namespaces.\n\n**Approach**:\n1. List all ClusterRoleBindings to identify bindings granting broad access to authenticated users\n2. Run `kubectl rbac-tool who-can get secrets` to find subjects that can read secrets across namespaces\n3. Discover that a ClusterRoleBinding grants `edit` to `system:authenticated`, giving all users write access cluster-wide\n4. Run KubiScan to identify service accounts with risky permissions and pods running with elevated service accounts\n5. Replace the ClusterRoleBinding with namespace-scoped RoleBindings for each team\n6. Disable automountServiceAccountToken for workloads that do not need API access\n7. Create a NetworkPolicy to isolate namespace traffic between teams\n\n**Pitfalls**: Removing ClusterRoleBindings can break CI\u002FCD pipelines and operators that rely on cluster-wide access. Always audit which workloads use the bindings before removing them. EKS maps IAM roles to Kubernetes groups via aws-auth ConfigMap, so RBAC changes must be coordinated with IAM role mappings.\n\n## Output Format\n\n```\nKubernetes RBAC Audit Report\n===============================\nCluster: production-eks (EKS 1.28)\nAudit Date: 2026-02-23\nNamespaces: 12\n\nRBAC INVENTORY:\n  ClusterRoles: 48 (18 custom, 30 system)\n  ClusterRoleBindings: 32 (12 custom, 20 system)\n  Roles (namespaced): 24\n  RoleBindings (namespaced): 36\n  Service Accounts: 67\n\nCRITICAL FINDINGS:\n[RBAC-001] ClusterRoleBinding Grants edit to system:authenticated\n  Binding: authenticated-edit\n  Effect: ALL authenticated users have edit access across ALL namespaces\n  Risk: Any user can modify resources in any namespace\n  Remediation: Replace with namespace-scoped RoleBindings per team\n\n[RBAC-002] Custom ClusterRole with Wildcard Permissions\n  ClusterRole: developer-admin\n  Rules: verbs=[\"*\"], resources=[\"*\"], apiGroups=[\"*\"]\n  Bindings: 4 users via developer-admin-binding\n  Risk: Equivalent to cluster-admin without the name\n  Remediation: Scope to specific resources and verbs needed\n\nSUMMARY:\n  Principals with cluster-admin: 6 (recommended: \u003C= 3)\n  Roles with wildcard permissions: 4\n  Service accounts with secret access: 12\n  Pods with auto-mounted tokens: 45 \u002F 67\n  Privileged containers: 8\n```\n","# Auditing Kubernetes Cluster RBAC\n\n## When to Use\n\n- When performing security assessments of Kubernetes clusters (EKS, GKE, AKS, or self-managed)\n- When validating that RBAC policies enforce least privilege for users and service accounts\n- When investigating potential lateral movement or privilege escalation within a Kubernetes cluster\n- When compliance audits require documentation of access controls and permissions\n- When onboarding new teams to a shared cluster and defining appropriate RBAC policies\n\n**Do not use** for network policy auditing (use Cilium or Calico network policy tools), for container image scanning (use Trivy or Grype), or for runtime security monitoring (use Falco or Sysdig Secure).\n\n## Prerequisites\n\n- kubectl configured with cluster-admin or equivalent read permissions to the target cluster\n- rbac-tool installed (`kubectl krew install rbac-tool` or binary from GitHub)\n- KubiScan installed (`pip install kubiscan`)\n- Kubeaudit installed (`brew install kubeaudit` or from GitHub releases)\n- Access to the cluster's audit logs for correlating RBAC findings with actual API access\n\n## Workflow\n\n### Step 1: Enumerate ClusterRoles and Roles with Dangerous Permissions\n\nIdentify roles with wildcard permissions, secret access, pod exec, or escalation capabilities.\n\n```bash\n# List all ClusterRoles with wildcard verb access\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        verbs = rule.get('verbs', [])\n        resources = rule.get('resources', [])\n        if '*' in verbs or '*' in resources:\n            print(f'ClusterRole: {name}')\n            print(f'  Verbs: {verbs}')\n            print(f'  Resources: {resources}')\n            print(f'  API Groups: {rule.get(\\\"apiGroups\\\", [])}')\n            print()\n\"\n\n# Find roles that can read secrets\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        verbs = rule.get('verbs', [])\n        if ('secrets' in resources or '*' in resources) and ('get' in verbs or 'list' in verbs or '*' in verbs):\n            if not name.startswith('system:'):\n                print(f'ClusterRole: {name} -> can access secrets (verbs: {verbs})')\n\"\n\n# Find roles with pod\u002Fexec permissions (container escape risk)\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        if 'pods\u002Fexec' in resources or 'pods\u002F*' in resources:\n            print(f'ClusterRole: {name} -> has pods\u002Fexec access')\n\"\n```\n\n### Step 2: Audit ClusterRoleBindings and RoleBindings\n\nReview bindings to identify who has elevated access and detect overly broad group assignments.\n\n```bash\n# List all ClusterRoleBindings with the subjects\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    name = binding['metadata']['name']\n    role = binding['roleRef']['name']\n    subjects = binding.get('subjects', [])\n    for subject in subjects:\n        kind = subject.get('kind', '')\n        subj_name = subject.get('name', '')\n        ns = subject.get('namespace', 'cluster-wide')\n        print(f'{name} -> Role: {role} | {kind}: {subj_name} ({ns})')\n\" | sort\n\n# Find bindings to cluster-admin\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    if binding['roleRef']['name'] == 'cluster-admin':\n        print(f\\\"Binding: {binding['metadata']['name']}\\\")\n        for subject in binding.get('subjects', []):\n            print(f\\\"  {subject.get('kind')}: {subject.get('name')} (ns: {subject.get('namespace', 'N\u002FA')})\\\")\n\"\n\n# Find bindings granting access to all authenticated users\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    for subject in binding.get('subjects', []):\n        if subject.get('name') in ['system:authenticated', 'system:unauthenticated']:\n            print(f\\\"WARNING: {binding['metadata']['name']} grants {binding['roleRef']['name']} to {subject['name']}\\\")\n\"\n```\n\n### Step 3: Scan with rbac-tool for Comprehensive Analysis\n\nUse rbac-tool for automated RBAC analysis including who-can queries and policy generation.\n\n```bash\n# Who can get secrets across all namespaces\nkubectl rbac-tool who-can get secrets\n\n# Who can create pods (potential for container escape)\nkubectl rbac-tool who-can create pods\n\n# Who can exec into pods\nkubectl rbac-tool who-can create pods\u002Fexec\n\n# Who can escalate privileges (bind\u002Fescalate verbs)\nkubectl rbac-tool who-can bind clusterroles\nkubectl rbac-tool who-can escalate clusterroles\n\n# Generate RBAC policy report\nkubectl rbac-tool analysis\n\n# Visualize RBAC relationships\nkubectl rbac-tool viz --outformat dot > rbac-graph.dot\ndot -Tpng rbac-graph.dot -o rbac-graph.png\n```\n\n### Step 4: Run KubiScan for Risky Permissions Detection\n\nUse KubiScan to automatically identify risky service accounts, pods, and RBAC configurations.\n\n```bash\n# Run KubiScan to find risky roles\npython3 -m kubiscan -rroles   # List risky Roles\npython3 -m kubiscan -rcr      # List risky ClusterRoles\npython3 -m kubiscan -rrb      # List risky RoleBindings\npython3 -m kubiscan -rcrb     # List risky ClusterRoleBindings\n\n# Find risky service accounts\npython3 -m kubiscan -rs       # Risky service accounts\n\n# Find pods running with risky service accounts\npython3 -m kubiscan -rp       # Risky pods\n\n# Check for privilege escalation paths\npython3 -m kubiscan -pe       # Privilege escalation vectors\n\n# Generate full report\npython3 -m kubiscan -a        # All checks\n```\n\n### Step 5: Audit Service Account Token Mounting and Usage\n\nCheck for unnecessary service account token mounts that could enable lateral movement from compromised pods.\n\n```bash\n# Find pods with automounted service account tokens\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    sa = pod['spec'].get('serviceAccountName', 'default')\n    automount = pod['spec'].get('automountServiceAccountToken', True)\n    if automount and sa != 'default':\n        print(f'{ns}\u002F{name} -> SA: {sa} (token auto-mounted)')\n\"\n\n# Find service accounts with non-default token secrets\nkubectl get serviceaccounts --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor sa in data['items']:\n    name = sa['metadata']['name']\n    ns = sa['metadata']['namespace']\n    secrets = sa.get('secrets', [])\n    if name != 'default' and len(secrets) > 0:\n        print(f'{ns}\u002F{name}: {len(secrets)} secret(s) bound')\n\"\n\n# Check for pods running as privileged or with host access\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    for container in pod['spec'].get('containers', []):\n        sc = container.get('securityContext', {})\n        if sc.get('privileged', False) or sc.get('runAsUser', 1) == 0:\n            print(f'RISK: {ns}\u002F{name}\u002F{container[\\\"name\\\"]} - privileged={sc.get(\\\"privileged\\\",False)} runAsRoot={sc.get(\\\"runAsUser\\\",\\\"not set\\\")==0}')\n\"\n```\n\n### Step 6: Run Kubeaudit for RBAC and Security Policy Validation\n\nExecute Kubeaudit for comprehensive security checks including RBAC-related findings.\n\n```bash\n# Run all kubeaudit checks\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig\n\n# Run specific RBAC-related checks\nkubeaudit privesc    # Check for allowPrivilegeEscalation\nkubeaudit rootfs     # Check for readOnlyRootFilesystem\nkubeaudit nonroot    # Check for runAsNonRoot\nkubeaudit capabilities  # Check for dangerous capabilities\n\n# Output as JSON for processing\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig -f json > kubeaudit-results.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| RBAC | Role-Based Access Control in Kubernetes, a method for regulating access to cluster resources based on the roles of individual users or service accounts |\n| ClusterRole | Cluster-wide role definition that specifies permissions (verbs on resources) applicable across all namespaces |\n| ClusterRoleBinding | Associates a ClusterRole with subjects (users, groups, service accounts) at the cluster scope |\n| Service Account | Identity associated with pods for authenticating to the Kubernetes API server, automatically mounted unless disabled |\n| automountServiceAccountToken | Pod spec field controlling whether the service account token is automatically mounted into the pod filesystem |\n| Privilege Escalation | RBAC verbs (bind, escalate, impersonate) that allow a user to grant themselves or others elevated permissions |\n\n## Tools & Systems\n\n- **kubectl**: Primary CLI for querying Kubernetes RBAC resources (roles, bindings, service accounts)\n- **rbac-tool**: kubectl plugin for RBAC analysis including who-can queries, visualization, and policy generation\n- **KubiScan**: Python tool for scanning Kubernetes RBAC for risky permissions and privilege escalation paths\n- **Kubeaudit**: Security auditing tool that checks pods and workloads for security anti-patterns including RBAC issues\n- **rakkess**: kubectl plugin showing access matrix for the current user across all resource types\n\n## Common Scenarios\n\n### Scenario: Auditing an EKS Cluster Shared by Multiple Development Teams\n\n**Context**: A shared EKS cluster serves four development teams. RBAC was configured during initial setup but has not been reviewed in 12 months. Teams report being able to access other teams' namespaces.\n\n**Approach**:\n1. List all ClusterRoleBindings to identify bindings granting broad access to authenticated users\n2. Run `kubectl rbac-tool who-can get secrets` to find subjects that can read secrets across namespaces\n3. Discover that a ClusterRoleBinding grants `edit` to `system:authenticated`, giving all users write access cluster-wide\n4. Run KubiScan to identify service accounts with risky permissions and pods running with elevated service accounts\n5. Replace the ClusterRoleBinding with namespace-scoped RoleBindings for each team\n6. Disable automountServiceAccountToken for workloads that do not need API access\n7. Create a NetworkPolicy to isolate namespace traffic between teams\n\n**Pitfalls**: Removing ClusterRoleBindings can break CI\u002FCD pipelines and operators that rely on cluster-wide access. Always audit which workloads use the bindings before removing them. EKS maps IAM roles to Kubernetes groups via aws-auth ConfigMap, so RBAC changes must be coordinated with IAM role mappings.\n\n## Output Format\n\n```\nKubernetes RBAC Audit Report\n===============================\nCluster: production-eks (EKS 1.28)\nAudit Date: 2026-02-23\nNamespaces: 12\n\nRBAC INVENTORY:\n  ClusterRoles: 48 (18 custom, 30 system)\n  ClusterRoleBindings: 32 (12 custom, 20 system)\n  Roles (namespaced): 24\n  RoleBindings (namespaced): 36\n  Service Accounts: 67\n\nCRITICAL FINDINGS:\n[RBAC-001] ClusterRoleBinding Grants edit to system:authenticated\n  Binding: authenticated-edit\n  Effect: ALL authenticated users have edit access across ALL namespaces\n  Risk: Any user can modify resources in any namespace\n  Remediation: Replace with namespace-scoped RoleBindings per team\n\n[RBAC-002] Custom ClusterRole with Wildcard Permissions\n  ClusterRole: developer-admin\n  Rules: verbs=[\"*\"], resources=[\"*\"], apiGroups=[\"*\"]\n  Bindings: 4 users via developer-admin-binding\n  Risk: Equivalent to cluster-admin without the name\n  Remediation: Scope to specific resources and verbs needed\n\nSUMMARY:\n  Principals with cluster-admin: 6 (recommended: \u003C= 3)\n  Roles with wildcard permissions: 4\n  Service accounts with secret access: 12\n  Pods with auto-mounted tokens: 45 \u002F 67\n  Privileged containers: 8\n```\n",{"name":5,"tags":49,"capec":51,"model":52,"tools":53,"domain":42,"maxTurns":57,"nist_csf":58,"subdomain":34,"description":7,"mitre_attack":63},[34,24,31,50,36,35,33],"access-control",[],"sonnet",[54,40,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[64,65],"T1021","T1610","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fgeneral\u002Foverview\u002Fanalyze","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-general-overview-analyze",{"tool":79,"command":80},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-general-overview-analyze",{"tool":82,"command":83},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-general-overview-analyze","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fgeneral\u002Foverview\u002Fanalyze\u002FSKILL.md",true,[87],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",716,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fgeneral\u002Foverview\u002Fanalyze\u002Findex.json",[94,117,138,158,180,196],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,37,43,106,107,108,109,110,111,112,113,114,115,42,116],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[124,101,125,104,126,127,128,42,40,129,130,131,132,133,37,134,135,30,136,137],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[145,146,147,148,149,150,42,40,151,129,28,152,37,30,153,154,155,156,157,52],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,165,166,167,168,169,170,43,171,42,116,172,173,174,175,176,177,178,179,37],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[187,188,102,189,167,169,190,43,191,171,42,116,129,192,193,194,195,179,37,106],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[203,102,167,204,190,43,205,206,42,116,207,208,209,210,211,212,37,106,213,214],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]